CVE-2021-38163: SAP NetWeaver Unrestricted File Upload Vulnerability

CVE-2021-38163 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2022-06-09

SAP NetWeaver (Visual Composer 7.0 RT) allows an authenticated non-administrative user to upload malicious files over a network. Successful exploitation enables the execution of operating system commands with the privileges of the Java Server process, potentially leading to full system compromise or denial of service.

Technologies: SAP NetWeaver. Vendors: SAP.

Quick answers

Is CVE-2021-38163 exploited in the wild?
Yes. CVE-2021-38163 is known to be exploited in the wild, first recorded on 9 June 2022. Treat it as urgent.
How severe is CVE-2021-38163?
Critical severity, with a CVSS score of 9.9, published 9 June 2022.
Which products and versions are affected?
SAP SE NetWeaver (Visual Composer 7.0 RT) 7.30, 7.31, 7.40, 7.50.
Is there a fix for CVE-2021-38163?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-38163 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-38163?
Check whether you run SAP NetWeaver. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • SAP SE NetWeaver (Visual Composer 7.0 RT) 7.30, 7.31, 7.40, 7.50

Timeline

  • 2021-09-14: disclosed: NVD Published Date
  • 2022-06-09: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.